[Q&A] Will the API Key be leaked? | 我的 API Key 会泄漏吗？ #561
-
🧐 问题描述 | Proposed SolutionI see api key go to endpoint of lobchat Might it be logged on the server or leak any other way ?
📝 补充信息 | Additional InformationNo response |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments
-
|
It won't be leaked. Let me explain: LobeChat supports two modes of use: Self-deploymentFor the self-deployment mode, all API Keys are directly entered on the server side, and the client cannot access them, so there is no possibility of any leakage; Using someone else's deployed versionFor example, the Since the API Key is stored on the client side, but the OpenAI request service is initiated on the server side. Therefore, in this mode, the API Key must be sent from the client to the server. This is the request in your screenshot. In the official implementation of LobeChat, we do not save or record the API Key sent from the client. You can check the source code of this part here. Note The repository behind the deployment of However, if you are using a deployment version provided by an unknown service provider, they may modify the corresponding server-side implementation to record your API Key. In this case, there is a possibility that your API Key could be leaked. Our recommendationAlthough we guarantee that the Note This also the reason why we call the domain is This will be convenient for data autonomy, controllability of network conditions. And you can aslo share your deployment with your friends. |
Beta Was this translation helpful? Give feedback.
-
并不会泄漏，让我解释一下背后的原因： LobeChat 的使用支持两种模式：1. 自部署 （Vercel 或者 Docker）；2. 使用别人部署的版本，但是填入自己的 API Key； 自部署针对自部署的模式，所有 API Key 会直接填写在服务端，且客户端无法获取，因此不会有任何泄漏的可能性； 使用别人部署的版本例如在 由于 API Key 保存在客户端，但是 OpenAI 的请求调用是在服务端发起的，所以这种模式下，API Key 必须要从前端发送到后端，即你截图中的所看到的情况。 LobeChat 的官方实现中，并不会保存或者记录从客户端发过来的 API Key。你可以在这里检查这部分的源码。 Note 部署 但是，如果你在使用一个未知服务商提供的 LobeChat 部署版本，对方有可能会修改相应的服务端实现以记录你的 API Key。这种情况下将有可能造成你的 API Key 泄漏。 我们的建议虽然我们保证 Note 这也是为什么我们把域名设为 如果不知道如何操作，我们也写了部署指南，可以实现非常方便的一键部署：https://github.com/lobehub/lobe-chat/blob/main/README.zh-CN.md#-%E5%BC%80%E7%AE%B1%E5%8D%B3%E7%94%A8 这无论是对于服务私密性、数据自主性、网络稳定性来说都很重要，同时你还可以把你的部署版本和你的小伙伴分享使用，很多用户也是这么使用的。 |
Beta Was this translation helpful? Give feedback.
-
|
我已经了解，感谢解释 |
Beta Was this translation helpful? Give feedback.
It won't be leaked. Let me explain:
LobeChat supports two modes of use:
A.Self-deployment (Vercel / Docker / ...);B.Using a version deployed by someone else, and entering your own API Key;Self-deployment
For the self-deployment mode, all API Keys are directly entered on the server side, and the client cannot access them, so there is no possibility of any leakage;
Using someone else's deployed version
For example, the
chat-preview.lobehub.comis this version (I will call itchat-previewbelow for short ). If users want to use it, they must enter their own API Key, because of this version don't have any API Key on the server side.Since the API Key is stored on the client side, but the …